glusterfs.git/rpc/rpc-transport/socket/src/socket.h, branch v3.7.19

socket: reduce rate of readv failure logs due to disconnect

2016-02-23T16:34:59+00:00

Backport of http://review.gluster.org/8210

... by using GF_LOG_OCCASIONALLY

Change-Id: I779ff32ead13c8bb446a57b5baccf068ae992df1
BUG: 1310969
Signed-off-by: Krishnan Parthasarathi 
Reviewed-on: http://review.gluster.org/8210
Tested-by: Atin Mukherjee 
Smoke: Gluster Build System 
NetBSD-regression: NetBSD Build System 
CentOS-regression: Gluster Build System 
Reviewed-by: Raghavendra G 
Reviewed-on: http://review.gluster.org/13487

build: fix ecdh.h and dh.h deps

2015-11-20T11:25:29+00:00

openssl/ecdh.h and openssl/dh.h are not available on all platforms,
especially rhel-5.
This patch adds check to autoconf and updates relevant source files.

Added conditional to test for SSL_OP_NO_TICKET and SSL_OP_NO_COMPRESSION
presence before setting the SSL context options.

Macros UTIME_OMIT and UTIME_NOW picked up from Fedora 22
/usr/include/bits/stat.h to help rhel-5 build.

Change-Id: I2bdee4fe643f9c1f5fe77cf89bd30946cd6b591a
Reviewed-on: http://review.gluster.org/#/c/12517/
BUG: 1258594
Signed-off-by: Milind Changire 
Reviewed-on: http://review.gluster.org/12518
Tested-by: NetBSD Build System 
Tested-by: Gluster Build System 
Reviewed-by: Kaleb KEITHLEY 
Reviewed-by: Niels de Vos

SSL improvements: do not fail if certificate purpose is set

2015-08-24T06:19:45+00:00

Since glusterfs shares the same settings for client-side
and server-side of SSL, we need to ignore any certificate
usage specification (SSL client vs SSL server), otherwise
SSL connexions will fail with 'unsupported cerritifcate"

Backport of I7ef60271718d2d894176515aa530ff106127bceb

BUG: 1247153
Change-Id: I04e2f50dafd84d6eee15010f045016c91a0e1aac
Signed-off-by: Emmanuel Dreyfus 
Reviewed-on: http://review.gluster.org/11842
Tested-by: Gluster Build System 
Tested-by: NetBSD Build System 
Reviewed-by: Kaleb KEITHLEY 
Reviewed-by: Jeff Darcy

SSL improvements: ECDH, DH, CRL, and accessible options

2015-08-05T11:52:04+00:00

- Introduce ssl.dh-param option to specify a file containinf DH parameters.
  If it is provided, EDH ciphers are available.

- Introduce ssl.ec-curve option to specify an elliptic curve name. If
  unspecified, ECDH ciphers are available using the prime256v1 curve.

- Introduce ssl.crl-path option to specify the directory where the
  CRL hash file can be found. Setting to NULL disable CRL checking,
  just like the default.

- Make all ssl.* options accessible through gluster volume set.

- In default cipher list, exclude weak ciphers instead of listing
  the strong ones.

- Enforce server cipher preference.

- introduce RPC_SET_OPT macro to factor repetitive code in glusterd-volgen.c

- Add ssl-ciphers.t test to check all the features touched by this change.

Backport of I7bfd433df6bbf176f4a58e770e06bcdbe22a101a

Change-Id: I2947eabe76ae0487ecad52a60befb7de473fc90c
BUG: 1247153
Signed-off-by: Emmanuel Dreyfus @
Reviewed-on: http://review.gluster.org/11763
Tested-by: NetBSD Build System 
Reviewed-by: Jeff Darcy

socket: use TCP_USER_TIMEOUT to detect client failures quicker

2015-03-17T12:10:17+00:00

Use the network.ping-timeout to set the TCP_USER_TIMEOUT socket option
(see 'man 7 tcp'). The option sets the transport.tcp-user-timeout option
that is handled in the rpc/socket layer on the protocol/server side.
This socket option makes detecting unclean disconnected clients more
reliable.

When the socket gets closed, any locks that the client held are been
released. This makes it possible to reduce the fail-over time for
applications that run on systems that became unreachable due to
a network partition or general system error client-side (kernel panic,
hang, ...).

It is not trivial to create a test-case for this at the moment. We need
a client that unclean disconnects and an other client that tries to take
over the lock from the disconnected client.

URL: http://supercolony.gluster.org/pipermail/gluster-devel/2014-May/040755.html
Change-Id: I5e5f540a49abfb5f398291f1818583a63a5f4bb4
BUG: 1129787
Signed-off-by: Niels de Vos 
Reviewed-on: http://review.gluster.org/8065
Tested-by: Gluster Build System 
Reviewed-by: soumya k 
Reviewed-by: Santosh Pradhan 
Reviewed-by: Kaleb KEITHLEY

socket: allow only one epoll thread to read msg fragments

2015-02-28T05:16:11+00:00

__socket_read_reply function releases sock priv->lock briefly for
notifying higher layers of message's xid. This could result in other
epoll threads that are processing events on this socket to read further
fragments of the same message. This may lead to incorrect fragment
processing and result in a crash.

Change-Id: I915665b2e54ca16f2ad65970e51bf76c65d954a4
BUG: 1197118
Signed-off-by: Krishnan Parthasarathi 
Signed-off-by: Shyam 
Reviewed-on: http://review.gluster.org/9742
Tested-by: Gluster Build System 
Reviewed-by: Raghavendra G 
Tested-by: Raghavendra G

socket/glusterd/client: enable SSL for management

2014-07-10T14:37:12+00:00

The feature is controlled by presence of the following file:

	/var/lib/glusterd/secure-access

See the comment near the definition of SECURE_ACCESS_FILE in glusterfs.h
for the rationale.  With this enabled, the following rules apply to
connections:

	UNIX-domain sockets never have SSL.

	Management-port sockets (both connecting and accepting, in
	daemons and CLI) have SSL based on presence of the file.

	Other IP sockets have SSL based on the existing client.ssl and
	server.ssl volume options.

Transport multi-threading is explicitly turned off in glusterd (it would
otherwise be turned on when SSL is) due to multi-threading issues.
Tests have been elided to avoid risk of leaving a file which will cause
all subsequent tests to run with management SSL still enabled.

IMPLEMENTATION NOTE
The implementation is a bit messy, and consists of two stages.  First we
decide whether to set the relevant fields in our context structure, based
on presence of the sentinel file OR a command-line override.  Later we
decide whether a particular connection should actually use SSL, based on the
context flags plus what kind of connection we're making[1] and what kind of
daemon we're in[2].

[1] inbound, outbound to glusterd port, other outbound
[2] glusterd, glusterfsd, other

TESTING NOTE
Instead of just running one special test for this feature, the ideal
would be to run all tests with management SSL enabled.  However, it
would be inappropriate or premature to set up an optional feature in the
patch itself.  Therefore, the method of choice is to submit a separate
patch on top, which modifies "cleanup" in include.rc to recreate the
secure-access file and associated SSL certificate/key files before each
test.

Change-Id: I0e04d6d08163893e24ec8c031748c5c447d7f780
BUG: 1114604
Signed-off-by: Jeff Darcy 
Reviewed-on: http://review.gluster.org/8094
Tested-by: Gluster Build System 
Reviewed-by: Vijay Bellur

transport/socket: fix connect/disconnect races

2013-06-04T22:37:54+00:00

We might receive a connect request while a disconnect is still in
progress, requiring more states and (the return of) poller generation
numbers to avoid redundant pollers.  We might also get either kind of
request from within our own rpc_transport_notify upcall, so we have to
avoid locking and use the PLEASE_DIE state instead.

Change-Id: Icbaacf96c516b607a79ff62c90b74d42b241780f
BUG: 970194
Signed-off-by: Jeff Darcy 
Reviewed-on: http://review.gluster.org/5137
Tested-by: Gluster Build System 
Reviewed-by: Anand Avati

socket: restructure disconnect/poll-thread interactions

2013-02-03T20:09:54+00:00

Change-Id: I792c28f52068e4ed666069b740739662685160bc
BUG: 906401
Signed-off-by: Jeff Darcy 
Reviewed-on: http://review.gluster.org/4456
Tested-by: Gluster Build System 
Reviewed-by: Anand Avati

rpc-transport/socket: implement read-ahead of RPC headers

2012-12-04T22:46:04+00:00

This reduces the number of read() system calls on the socket to
complete the full RPC fragment reading.

Change-Id: I421a53af195ead4aad70e09e0172a61ad7912d83
BUG: 821087
Signed-off-by: Anand Avati 
Reviewed-on: http://review.gluster.org/3855
Tested-by: Gluster Build System 
Reviewed-by: Jeff Darcy 
Reviewed-by: Amar Tumballi